Insights / Threat Intelligence
Threat Intelligence
PHP2Shell: Two Critical PHP Flaws, the Attack Path, and What to Do Today
PHP2Shell lets an unauthenticated attacker run code on a web server, or read secrets from its memory, with one crafted request. Attackers started trying it four days before the patch existed. Here is what it is, how the attack works, the indicators published so far, and the steps to take today.
Do these three things first
- Find every PHP install. Include web servers, containers, control panels such as cPanel and Plesk, and appliances that bundle
php.exeorphp-cgi.exe. - Patch and restart. Move to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or to your vendor's fixed package. Restart PHP-FPM or Apache and rebuild container images.
- Hunt and rotate. Search logs back to 17 October. On internet facing hosts that stayed unpatched after 20 October, assume anything PHP could read is exposed and rotate it.
Check a site now: our free PHP2Shell Checker reads the PHP version a domain shows and tells you whether it is in range. No signup, nothing stored, and it never attempts the vulnerability.
What PHP2Shell is
PHP2Shell is the public name for CVE-2026-109618 and CVE-2026-109619, two memory safety bugs in PHP core found by researchers at Wiz, OpenAI, Calif and Quarkslab. Both are rated CVSS v4.0 9.2. The flaw is in PHP itself, not in one application, so patching WordPress, Drupal, Joomla or Magento does not fix it.
Both bugs come from the same design habit. When PHP hits a fatal error or runs out of memory, it abandons the request mid flight using a C call named longjmp. Some code paths then leave request memory half set up, or leave global state pointing at memory that has been freed. In plain terms, an attacker can make PHP fail at a chosen moment and then steer what PHP does with the leftovers.
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| Trigger | Out of memory during early request handling, for example multipart parsing | Fatal error or diagnostic that leaves stale global state |
| Root cause | Partly initialized request memory treated as valid | Global state outlives the freed memory it points to |
| Demonstrated impact | Unauthenticated code execution through a use after free in the session upload progress code, plus a memory disclosure path | Unauthenticated code execution through fatal error backtraces (PHP 8.5) and an OPcache type confusion |
Impact. Code execution as the web worker user, disclosure of passwords, tokens, API keys and certificates from other requests, and denial of service. The memory disclosure path needs no code execution at all.
Exposure. Every PHP install serving web requests is affected: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php the highest risk, because the demonstrated exploit fires before any application code runs. Any reachable PHP endpoint can be targeted, including static forms, login routes and health checks.
| Branch | Fixed in | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Patched 21 October 2026 |
| PHP 8.4 | 8.4.27 | Patched 21 October 2026 |
| PHP 8.3 | 8.3.36 | Patched 21 October 2026 |
| PHP 8.2 | 8.2.35 | Patched 21 October 2026 |
| PHP 8.1 and older | None from PHP | End of life. Affected, with no upstream fix. Check your OS or hosting vendor for a backport. |
The scale is large. VulnCheck counts PHP on 2,608,039 internet facing hosts, with more than 700,000 on PHP 3.x to 7.3 and about 400,000 on 7.4, 8.0 or 8.1. VirusTotal sees about 5.1 million IP addresses running PHP, but only 1.1 million reveal a version, so version scans undercount.
The attack path
The attack needs one crafted web request and no login. It makes PHP fail at a moment the attacker chooses, then steers what PHP does with the leftover memory.
One public analysis shows the session upload progress feature as the demonstrated route for the corruption path, which is why disabling it is a partial stopgap.
Why it is hard to see
- No application code runs, so WordPress, Drupal or Laravel logs show nothing.
- Workers can stay stable and responses can return HTTP 200, according to CrowdStrike.
- The one reliable server side trace is a memory limit fatal in the web server error log.
- On the disclosure path, leaked memory can appear as an unusually large
PHPSESSIDSet-Cookie header. - After code execution, the visible signs are on the host: PHP or the web server launching shells or downloading files.
Timeline: attacks began before the patch
The first known attempt came four days before the fix. Disclosure was meant to be coordinated, but details and a proof of concept leaked early, and PHP moved its release forward. Do not treat the public disclosure date as the earliest date of exploitation.
| Date (UTC) | What happened | Reported by |
|---|---|---|
| 22 Oct | Attempts grew from thousands before disclosure to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions since. | Cloudflare |
| 21 Oct, 20:30 | No exploitation yet observed on partner systems. CISA's alert said the same at publication. | Huntress, CISA |
| 21 Oct, 17:22 | A proof of concept exploitation attempt hits canary systems from 221.14.159[.]134. | VulnCheck |
| 21 Oct, about 14:00 | PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. More proofs of concept appear within hours. | PHP, Amazon |
| 21 Oct, 08:36 | First PHP2Shell request reaches sensors, less than an hour after a vendor published built images containing the fix. | ELLIO |
| 21 Oct, about 02:00 | Earliest proof of concept exploits, roughly 12 hours before release. | Amazon |
| 20 Oct | Details leak and circulate. The bugs are independently reproduced that evening. | Armis, VulnCheck |
| 17 Oct | First known attempt, from 103.216.220[.]92, an IP tied to a commercial anonymization network. | Amazon |
Many early attempts failed. watchTowr reportedly found that none of the circulating proofs of concept achieved code execution, and VulnCheck saw one unsuccessful webshell drop. Treat that as a snapshot: working exploits exist and payloads are being mutated.
Indicators of compromise
Published indicators so far describe scanning and exploit attempts, not confirmed compromises. No vendor has released attacker infrastructure, payload hashes or command and control domains from a successful intrusion. Use these for alerting and retro hunting from 17 October, and prefer the structural indicators below, which are harder for attackers to change. IPs are defanged. Remove the brackets before use.
Source IP addresses
| IP address | Seen | Reported by | Notes | Suggested action |
|---|---|---|---|---|
103.216.220[.]92 | 17 Oct | Amazon | First known attempt, geolocated to Australia, commercial anonymization network | Investigate, do not block |
31.223.184[.]166 | 21 Oct | Amazon | Anonymized infrastructure | Investigate, do not block |
37.19.200[.]5 | 21 Oct | Amazon | Anonymized infrastructure | Investigate, do not block |
134.209.159[.]64 | 21 Oct | Amazon | Anonymized infrastructure | Investigate, do not block |
103.114.163[.]188 | 21 Oct | Amazon | Anonymized infrastructure | Investigate, do not block |
95.217.98[.]37 | 21 Oct | Amazon | Anonymized infrastructure | Investigate, do not block |
85.11.167[.]243 | 21 Oct | VulnCheck | User agent php2shell-scan/109618, targets CVE-2026-109618 | Hunt, alert |
45.198.224[.]169 | 21 Oct | VulnCheck | User agent php2shell-scan/109618, targets CVE-2026-109618 | Hunt, alert |
109.71.252[.]97 | 21 Oct | VulnCheck | Used both CVEs | Hunt, alert |
221.14.159[.]134 | 21 Oct, 17:22 to 17:24 | VulnCheck | AS4837 China Unicom (Henan), upload progress path | Hunt. Blocking is low risk but short lived |
Amazon states its addresses include shared anonymization infrastructure that is not exclusive to this activity, so a hit means investigate, not convict. Expect these IPs to go stale within days to weeks.
User agents and request strings
| Indicator | Type | Reported by | Durability |
|---|---|---|---|
php2shell-scan/109618 | HTTP user agent | VulnCheck, ELLIO | Trivial to change |
php2shell-109618 | HTTP user agent | ELLIO | Trivial to change |
php2shell-verify/1.0 | HTTP user agent | ELLIO | Trivial to change |
Mozilla/5.0 (php2shell-poc) | HTTP user agent | VulnCheck | Trivial to change |
------p2s9rdme2st6guc9g0rafic | Multipart boundary | VulnCheck. ELLIO saw one shared boundary across three networks | Possibly hard coded in a proof of concept |
p2s.txt | Upload filename | VulnCheck | Possibly hard coded in a proof of concept |
Cloudflare reports attackers mutating payloads to slip past its rules, so absence of these strings proves nothing.
Team Cymru active exploitation list (broader context)
On 22 October Team Cymru published 1,187 IP addresses that its Total Insights pipeline currently flags as actively exploiting known vulnerabilities at a score of 90 or higher, across products such as Ivanti, Joomla, Laravel, XWiki, Webmin and phpunit. Their reasoning is that IPs already exploiting other flaws opportunistically will probably try any PHP2Shell proof of concept too.
This list is not PHP2Shell activity. None of the PHP2Shell sightings above appear in it, and about two thirds of it sits in the 34.x, 35.x and 136.x cloud hosting ranges, where addresses change hands quickly. Use it to raise alert priority and to retro hunt, not for blanket blocking.
Show the full list (1,187 IPs, source: Team Cymru)
1.95.73.195 8.220.129.148 8.228.70.0 8.228.76.85 8.228.88.238 8.228.119.125 8.229.9.185 8.229.27.200 8.229.48.35 8.229.78.183 8.229.135.44 8.229.211.55 8.234.147.244 8.234.190.46 8.234.201.4 8.234.204.234 8.234.214.137 8.235.76.14 8.235.113.39 13.140.80.140 13.140.242.159 13.143.174.142 13.143.188.149 23.94.144.9 27.123.253.68 27.123.253.80 27.123.253.81 27.123.253.84 27.123.253.87 27.123.253.167 27.123.253.179 27.123.253.191 27.123.253.194 27.123.253.200 27.123.253.205 27.123.253.206 27.123.253.212 27.123.253.215 27.123.254.26 27.123.254.27 27.147.224.153 27.147.242.48 27.220.190.221 34.6.17.32 34.6.17.166 34.6.37.38 34.6.84.234 34.6.99.237 34.6.190.73 34.6.208.148 34.6.252.157 34.7.46.81 34.7.77.17 34.7.94.217 34.7.150.75 34.7.228.89 34.7.251.242 34.9.92.98 34.9.116.86 34.11.75.74 34.11.126.229 34.12.86.52 34.12.95.191 34.12.96.179 34.12.113.29 34.12.141.85 34.12.156.255 34.12.170.82 34.12.234.112 34.12.246.247 34.12.249.202 34.13.137.190 34.13.153.188 34.19.138.127 34.19.148.2 34.19.156.226 34.19.179.78 34.19.189.191 34.19.206.202 34.19.208.243 34.19.210.25 34.19.212.97 34.19.219.104 34.19.226.199 34.19.230.199 34.19.239.226 34.19.241.30 34.19.244.248 34.19.252.55 34.19.254.241 34.21.5.217 34.21.17.117 34.21.31.241 34.21.104.226 34.21.109.199 34.21.143.44 34.21.151.181 34.21.189.99 34.21.197.23 34.21.222.75 34.22.168.4 34.22.183.181 34.22.226.10 34.23.55.184 34.23.56.252 34.23.73.163 34.23.229.138 34.24.9.239 34.24.37.154 34.24.48.66 34.24.126.168 34.24.178.204 34.24.190.69 34.26.95.76 34.26.104.177 34.26.225.1 34.32.171.197 34.32.254.232 34.34.28.161 34.34.43.160 34.34.55.86 34.34.60.252 34.34.81.102 34.34.101.184 34.34.112.8 34.34.150.169 34.38.87.66 34.38.88.239 34.38.241.44 34.39.129.246 34.39.131.95 34.39.136.220 34.39.140.128 34.39.163.213 34.39.169.21 34.39.170.223 34.39.187.208 34.39.189.230 34.39.196.106 34.39.197.235 34.39.210.128 34.39.211.156 34.39.214.95 34.39.216.210 34.39.217.2 34.39.217.225 34.39.220.247 34.39.231.98 34.39.237.75 34.39.237.86 34.39.248.94 34.40.12.26 34.40.23.218 34.40.56.211 34.40.60.74 34.40.65.192 34.40.97.154 34.40.106.240 34.40.113.52 34.40.115.38 34.40.120.76 34.44.213.188 34.45.46.15 34.47.0.253 34.47.16.34 34.47.26.173 34.47.28.211 34.47.29.192 34.47.30.101 34.47.43.120 34.47.46.122 34.47.51.141 34.47.51.191 34.47.60.169 34.47.62.242 34.48.2.95 34.48.51.38 34.48.162.128 34.48.185.81 34.48.204.65 34.48.223.214 34.52.220.122 34.52.251.185 34.53.92.198 34.53.147.48 34.53.162.201 34.53.214.124 34.53.245.46 34.53.252.42 34.57.18.143 34.57.109.38 34.58.177.143 34.62.34.3 34.62.151.162 34.62.167.195 34.62.203.66 34.62.224.17 34.62.232.103 34.62.250.177 34.69.72.242 34.73.103.198 34.73.250.231 34.74.15.154 34.74.40.252 34.74.79.239 34.74.87.143 34.74.118.71 34.75.16.222 34.75.66.23 34.75.129.110 34.75.131.83 34.75.155.23 34.76.124.47 34.77.7.212 34.77.232.64 34.79.56.125 34.80.67.33 34.80.121.128 34.80.135.175 34.80.182.192 34.80.187.7 34.80.200.168 34.80.202.207 34.80.236.90 34.80.254.44 34.81.5.43 34.81.6.171 34.81.23.140 34.81.27.13 34.81.33.248 34.81.45.85 34.81.46.151 34.81.94.10 34.81.137.64 34.81.178.159 34.81.186.246 34.81.190.147 34.81.191.236 34.81.221.84 34.81.222.161 34.81.251.52 34.82.130.149 34.82.235.150 34.83.2.251 34.83.60.58 34.83.66.181 34.84.28.17 34.84.84.184 34.84.117.79 34.84.125.196 34.84.142.236 34.84.162.244 34.84.215.31 34.84.248.173 34.85.23.32 34.85.37.21 34.85.68.154 34.85.81.102 34.85.110.188 34.85.121.180 34.85.162.235 34.85.215.123 34.85.217.40 34.86.15.76 34.86.26.236 34.86.92.95 34.86.97.97 34.86.150.159 34.86.248.10 34.87.21.213 34.87.26.215 34.87.43.128 34.87.85.82 34.87.90.216 34.87.129.90 34.87.137.23 34.87.144.69 34.87.154.171 34.87.171.251 34.89.162.226 34.89.170.20 34.89.180.184 34.89.185.117 34.89.194.51 34.89.213.199 34.89.214.5 34.89.229.69 34.89.235.29 34.89.245.114 34.89.252.118 34.90.15.4 34.90.87.206 34.90.107.164 34.90.108.204 34.90.174.88 34.90.204.87 34.90.207.149 34.90.246.60 34.90.254.179 34.91.3.211 34.91.33.184 34.91.87.50 34.91.87.129 34.91.102.163 34.91.133.21 34.91.204.7 34.91.233.34 34.95.18.75 34.95.24.80 34.95.43.65 34.95.48.207 34.95.49.219 34.95.134.17 34.95.148.68 34.95.148.192 34.95.150.200 34.95.166.25 34.95.168.235 34.95.169.189 34.95.177.83 34.95.188.6 34.95.197.50 34.95.200.208 34.95.206.136 34.95.213.121 34.95.214.130 34.95.243.221 34.100.153.150 34.104.138.183 34.104.139.120 34.104.141.20 34.104.148.7 34.104.160.36 34.104.161.170 34.104.171.175 34.104.174.18 34.104.203.249 34.104.217.182 34.104.223.96 34.107.34.79 34.107.35.18 34.107.43.64 34.107.110.212 34.107.116.240 34.118.134.92 34.118.138.82 34.118.154.37 34.118.154.211 34.118.155.197 34.118.172.224 34.118.177.60 34.118.181.111 34.118.196.103 34.123.171.95 34.124.138.175 34.124.155.214 34.124.158.187 34.124.161.58 34.124.163.2 34.124.179.4 34.124.186.84 34.124.210.232 34.124.221.40 34.124.235.67 34.124.247.79 34.126.108.82 34.126.123.203 34.126.135.191 34.126.153.45 34.126.174.200 34.127.6.25 34.133.232.249 34.138.78.102 34.138.82.100 34.139.34.3 34.139.199.80 34.139.246.167 34.139.254.5 34.140.49.95 34.141.15.231 34.141.42.31 34.141.69.105 34.141.93.225 34.141.150.44 34.142.212.50 34.142.226.63 34.142.235.203 34.143.140.172 34.143.149.88 34.143.149.128 34.143.153.195 34.143.163.137 34.143.176.226 34.143.189.119 34.143.208.238 34.143.226.143 34.143.233.155 34.143.254.176 34.145.248.40 34.146.28.3 34.146.34.69 34.146.45.160 34.146.72.70 34.146.75.136 34.146.80.211 34.146.86.137 34.146.109.172 34.146.131.23 34.146.152.31 34.146.157.194 34.146.159.157 34.146.164.12 34.146.185.119 34.146.189.40 34.146.198.30 34.146.217.90 34.146.224.240 34.146.231.90 34.146.244.192 34.147.7.247 34.147.9.103 34.147.9.145 34.148.12.173 34.148.49.9 34.148.67.124 34.148.118.59 34.148.202.139 34.148.236.59 34.148.248.253 34.150.136.2 34.150.216.166 34.150.239.190 34.151.192.129 34.151.196.35 34.151.201.141 34.151.204.44 34.151.205.161 34.151.218.215 34.151.219.113 34.151.221.183 34.151.224.220 34.151.234.92 34.151.235.181 34.151.235.215 34.151.247.79 34.151.249.231 34.151.252.220 34.152.9.109 34.152.21.75 34.152.25.68 34.152.28.138 34.152.33.225 34.152.35.118 34.152.41.129 34.152.45.192 34.153.200.191 34.153.201.44 34.156.16.104 34.156.61.57 34.156.103.50 34.156.111.120 34.156.118.247 34.156.119.80 34.156.128.197 34.156.139.4 34.156.178.157 34.156.194.143 34.156.209.1 34.156.236.236 34.158.38.172 34.158.41.183 34.158.181.129 34.159.2.77 34.159.9.120 34.159.55.185 34.159.58.63 34.159.70.147 34.159.86.33 34.159.105.175 34.159.107.14 34.159.114.82 34.159.121.36 34.159.128.35 34.159.148.122 34.159.153.97 34.159.167.237 34.159.172.153 34.159.175.254 34.159.191.127 34.159.199.254 34.159.213.187 34.159.235.26 34.168.22.16 34.168.204.250 34.168.215.71 34.168.218.1 34.168.228.28 34.168.248.96 34.169.137.52 34.171.154.46 34.172.9.102 34.177.95.38 34.177.97.172 34.177.97.180 34.178.60.69 34.178.62.0 34.178.113.211 34.178.116.217 34.178.119.101 34.178.133.15 34.178.163.194 34.178.172.50 34.178.177.192 34.178.195.242 34.178.215.179 34.178.235.123 34.179.142.84 34.179.143.104 34.179.153.201 34.179.180.167 34.179.185.147 34.179.210.121 34.179.222.58 34.179.248.182 34.179.252.44 34.180.68.8 34.180.73.113 34.180.80.74 34.180.82.252 34.180.89.65 34.180.96.128 34.180.109.195 34.180.122.99 34.181.136.181 34.181.152.153 34.181.167.57 34.181.177.216 34.181.179.9 34.181.213.128 34.181.218.43 34.181.218.133 34.181.234.204 34.181.249.63 34.182.140.203 34.182.146.200 34.182.155.7 34.182.241.91 34.185.136.201 34.185.144.20 34.185.177.165 34.185.178.103 34.185.187.167 34.185.196.17 34.185.218.203 34.186.55.183 34.186.112.104 34.186.113.100 34.186.201.69 34.186.203.161 34.186.207.146 34.187.25.73 34.187.48.107 34.187.119.56 34.187.169.24 34.187.210.221 35.185.3.140 35.185.77.35 35.185.111.215 35.185.118.188 35.185.165.161 35.186.146.137 35.187.231.47 35.188.49.43 35.189.135.71 35.189.191.246 35.190.130.255 35.190.146.89 35.193.29.161 35.194.121.79 35.194.130.82 35.194.210.76 35.194.214.9 35.194.247.186 35.195.4.194 35.195.132.81 35.196.2.53 35.196.41.154 35.196.128.16 35.196.153.23 35.196.190.119 35.196.252.168 35.198.6.142 35.198.6.169 35.198.9.61 35.198.11.22 35.198.14.227 35.198.16.57 35.198.17.248 35.198.27.124 35.198.29.58 35.198.32.128 35.198.37.200 35.198.46.45 35.198.60.29 35.198.64.79 35.198.79.68 35.198.85.212 35.198.92.138 35.198.113.32 35.198.136.30 35.198.187.101 35.198.201.80 35.198.210.241 35.199.51.238 35.199.68.204 35.199.72.82 35.199.82.150 35.199.85.150 35.199.99.150 35.199.108.206 35.199.114.18 35.199.120.56 35.200.5.54 35.200.12.8 35.200.19.250 35.200.25.156 35.200.66.99 35.201.131.36 35.201.173.66 35.201.243.0 35.201.254.66 35.202.182.249 35.203.22.103 35.203.24.86 35.203.26.153 35.203.33.76 35.203.37.154 35.203.48.109 35.203.53.250 35.203.63.146 35.203.97.87 35.203.102.11 35.203.105.207 35.204.20.70 35.204.112.146 35.204.198.10 35.221.0.20 35.221.67.186 35.221.75.146 35.221.82.178 35.221.91.113 35.221.101.183 35.221.109.53 35.221.122.164 35.221.126.243 35.221.178.81 35.221.222.255 35.221.249.60 35.222.167.213 35.229.153.176 35.230.96.215 35.230.170.140 35.230.175.26 35.231.226.99 35.231.230.44 35.233.5.72 35.233.42.237 35.233.112.19 35.233.214.179 35.234.19.132 35.234.29.111 35.234.43.68 35.234.103.121 35.234.171.110 35.234.187.58 35.236.140.188 35.236.171.223 35.236.226.48 35.236.243.208 35.237.0.55 35.237.23.249 35.237.74.73 35.237.181.76 35.237.226.153 35.238.249.149 35.240.39.194 35.240.134.159 35.240.137.206 35.240.156.31 35.240.156.86 35.240.183.117 35.240.199.59 35.240.217.183 35.240.217.222 35.241.154.172 35.241.164.37 35.241.216.180 35.242.222.173 35.242.248.44 35.243.74.14 35.243.98.200 35.243.100.85 35.243.101.196 35.243.111.1 35.243.116.141 35.243.155.113 35.243.161.121 35.245.32.249 35.245.104.86 35.245.131.226 35.245.203.0 35.245.236.124 35.246.152.18 35.246.203.72 35.246.206.36 35.246.214.28 35.246.231.211 35.246.236.15 35.246.237.40 35.246.248.152 35.247.129.72 35.247.146.93 35.247.162.222 35.247.187.2 35.247.195.30 35.247.203.57 35.247.211.10 35.247.218.3 35.247.228.169 35.247.245.80 35.247.247.159 35.247.247.220 36.50.250.37 36.255.81.222 36.255.82.139 36.255.82.170 36.255.82.187 36.255.82.190 36.255.82.235 36.255.82.246 36.255.82.253 36.255.82.255 37.111.215.95 37.111.218.29 37.111.218.108 37.111.218.169 37.111.218.182 37.111.218.207 37.111.222.57 37.120.186.231 37.120.213.13 38.60.216.218 38.126.46.110 38.148.20.75 41.223.139.111 42.0.7.193 42.0.7.204 42.0.7.213 42.0.7.219 42.0.7.235 42.0.7.240 42.0.7.248 42.0.7.250 43.108.120.121 43.128.100.146 43.155.183.44 43.173.38.56 43.226.36.132 43.230.211.12 43.246.202.106 45.8.132.75 45.33.28.47 45.43.36.172 45.43.37.254 45.56.103.154 45.118.68.56 45.124.15.230 45.137.194.154 45.140.193.140 45.141.26.3 45.148.10.15 45.148.10.95 45.153.34.122 45.153.34.149 45.156.87.6 45.156.87.16 45.203.220.220 47.77.204.57 50.31.235.100 50.31.235.102 50.114.236.142 51.159.4.12 58.145.185.136 58.145.186.196 58.145.187.200 58.145.188.177 58.145.188.202 58.145.189.233 59.153.202.112 59.153.202.113 62.146.226.80 64.64.255.170 64.226.84.77 65.109.215.207 66.175.208.166 69.164.207.173 79.124.58.82 82.156.186.122 85.203.21.14 85.203.21.21 85.203.21.24 85.203.21.25 85.203.21.27 85.203.21.30 85.203.21.38 85.203.21.53 85.203.21.93 85.203.21.96 85.203.21.100 85.203.21.116 85.203.21.135 85.203.21.139 85.203.21.150 85.203.21.170 85.203.21.197 89.126.211.166 89.247.33.110 92.242.198.105 93.123.109.163 93.123.109.228 93.123.109.247 93.152.221.26 95.130.227.78 96.126.117.80 97.107.140.120 102.129.255.213 102.201.110.181 102.244.97.185 103.7.120.63 103.7.120.167 103.10.54.130 103.10.54.163 103.14.33.168 103.23.207.3 103.25.249.74 103.25.249.77 103.25.249.88 103.25.249.213 103.25.250.251 103.31.153.253 103.42.228.86 103.42.228.93 103.46.186.148 103.54.108.11 103.54.108.178 103.56.232.39 103.59.160.245 103.63.101.24 103.71.47.166 103.71.47.173 103.73.46.6 103.73.46.215 103.73.47.126 103.75.138.11 103.75.139.8 103.79.184.145 103.81.105.186 103.84.59.230 103.84.133.173 103.84.133.248 103.84.133.255 103.87.250.7 103.87.250.49 103.87.250.90 103.87.250.99 103.87.250.102 103.87.250.188 103.87.251.60 103.96.69.78 103.96.105.136 103.115.101.3 103.115.158.79 103.122.250.20 103.122.251.117 103.127.29.111 103.127.84.171 103.130.113.177 103.132.179.173 103.132.179.184 103.132.179.189 103.133.201.241 103.133.206.190 103.135.90.94 103.135.252.72 103.135.254.141 103.136.203.23 103.137.40.180 103.137.67.235 103.138.144.223 103.138.173.52 103.140.235.56 103.141.3.194 103.145.28.99 103.146.10.7 103.146.16.13 103.147.107.50 103.153.170.22 103.153.170.26 103.153.170.196 103.153.210.82 103.153.211.94 103.153.230.110 103.155.27.147 103.159.51.70 103.159.172.76 103.160.205.37 103.160.252.126 103.161.2.42 103.161.2.68 103.163.139.125 103.166.230.138 103.167.208.215 103.169.158.44 103.178.67.53 103.182.213.192 103.185.25.41 103.187.68.236 103.199.108.142 103.199.108.208 103.199.111.94 103.204.210.153 103.214.201.168 103.216.57.154 103.220.204.169 103.242.21.87 103.242.219.88 104.154.26.200 104.160.176.32 104.196.17.69 104.196.151.133 104.196.161.44 104.196.185.88 104.196.203.105 104.198.91.98 104.199.150.237 104.199.172.176 104.199.218.8 104.199.230.95 104.199.235.85 104.199.243.95 104.234.186.154 107.150.123.48 107.155.48.46 107.167.182.152 107.170.13.163 107.175.132.47 114.130.98.165 115.187.18.20 115.191.32.57 118.145.104.37 118.145.104.105 118.193.33.239 119.15.169.38 119.28.84.193 120.48.152.13 120.79.15.49 120.211.74.131 121.43.148.69 122.155.166.90 123.0.16.38 123.253.3.13 123.253.36.170 124.158.13.141 129.146.23.7 130.12.180.32 130.211.106.14 136.66.53.74 136.66.58.120 136.66.72.44 136.66.134.148 136.66.146.241 136.66.158.66 136.67.66.135 136.67.102.155 136.67.144.233 136.67.165.186 136.67.219.199 136.67.222.2 136.69.135.134 136.69.215.213 136.69.227.88 136.70.12.130 136.70.62.1 136.70.62.221 136.70.65.144 136.70.72.114 136.70.74.204 136.70.95.65 136.70.99.135 136.70.120.179 136.70.127.7 136.70.138.152 136.70.172.181 136.70.191.162 136.70.194.91 136.70.196.212 136.70.201.136 136.71.115.222 136.85.7.70 136.85.31.180 136.85.42.250 136.85.60.38 136.85.70.76 136.85.76.174 136.85.79.130 136.85.92.181 136.86.169.10 136.86.197.123 136.87.7.143 136.87.60.21 136.87.66.131 136.87.81.206 136.87.86.206 136.87.96.139 136.87.98.210 136.87.101.192 136.87.112.149 136.87.117.82 136.87.123.94 136.87.125.17 136.87.129.47 136.87.135.6 136.87.137.164 136.87.142.150 136.87.154.195 136.87.156.40 136.87.157.25 136.90.26.92 136.90.28.120 136.90.97.40 136.90.101.46 136.92.4.120 136.92.8.91 136.92.13.137 136.92.18.201 136.107.12.44 136.107.27.201 136.107.32.213 136.107.33.145 136.107.38.153 136.107.80.78 136.107.80.134 136.107.147.139 136.107.149.15 136.107.152.22 136.107.167.225 136.107.176.196 136.107.206.240 136.107.207.183 136.107.214.36 136.107.217.202 136.108.24.58 136.108.53.209 136.108.62.65 136.108.97.105 136.108.98.203 136.108.100.115 136.108.138.216 136.108.149.185 136.108.154.152 136.108.175.51 136.108.205.8 136.108.228.16 136.108.237.144 136.109.22.166 136.109.108.251 136.110.28.221 136.110.49.251 136.110.57.140 136.110.74.220 136.110.108.191 136.110.124.107 136.111.211.61 136.116.138.1 136.118.175.7 138.197.85.193 140.245.33.214 140.245.43.35 140.245.61.25 144.31.7.15 144.48.109.34 144.91.81.102 144.225.6.184 146.148.122.37 147.15.15.226 147.93.171.213 147.182.183.163 149.78.186.49 152.32.225.117 152.32.236.102 157.10.186.28 157.66.54.190 157.245.84.42 160.154.31.234 160.187.108.193 160.187.211.90 160.187.211.233 160.202.146.232 160.202.146.236 160.202.146.238 160.236.58.116 160.250.132.238 161.120.181.157 161.120.187.230 161.132.49.125 162.4.222.142 162.35.28.121 163.7.1.156 163.61.17.82 163.128.210.228 165.99.207.153 165.99.216.237 165.101.222.104 165.154.173.148 165.154.218.226 167.71.233.141 167.254.79.1 169.58.111.93 169.58.206.194 169.239.75.138 171.34.139.222 172.68.221.154 172.68.221.162 172.68.221.166 172.68.221.172 172.105.109.85 172.233.190.104 172.234.143.92 172.234.155.181 172.235.245.36 172.236.233.65 173.249.6.158 177.10.160.46 178.128.97.205 180.93.54.84 180.181.122.134 180.210.165.179 184.154.245.42 185.18.215.184 185.122.171.146 185.126.202.85 185.177.72.50 185.177.72.51 185.194.178.92 185.201.227.49 190.171.189.85 192.3.90.20 193.148.56.90 194.163.173.251 195.178.110.22 196.238.51.120 198.12.89.177 202.86.220.30 202.86.220.242 202.125.66.58 202.134.8.193 202.134.9.130 202.134.9.137 202.134.9.140 202.134.9.141 202.134.10.131 202.134.10.132 202.134.10.137 202.134.11.226 202.181.16.97 203.20.109.14 203.82.199.74 203.195.82.138 204.16.174.148 207.175.25.248 207.175.63.13 209.141.51.90 212.18.114.31 217.60.7.209 217.142.187.160 223.83.183.254 223.123.65.54
A good use is a join: take any host in this list that also sent a request matching the structural indicators below, and treat that as a high confidence lead. Copied IPs are plain, not defanged, so they paste straight into a watchlist or indicator import.
Structural indicators (more durable)
- Request: multipart/form-data POST, PUT or PATCH containing
PHP_SESSION_UPLOAD_PROGRESS, especially with deep[]nesting, large or stalled bodies, no valid Content-Length, or a PHPSESSID supplied in the body. Any.phppath can be targeted. - Error logs: repeated "Allowed memory size exhausted" fatals, early warnings ending "in Unknown on line 0", timeouts, and worker segfault or respawn bursts.
- Responses: unusually large Set-Cookie PHPSESSID headers, which can carry leaked heap memory on the disclosure path.
- Session files: persistent locks on
sess_*files,upload_progress_prefixes, or session files holding injected PHP or serialized objects. - Host and network: the web user spawning sh, bash or cmd, a web server process downloading files, or new outbound connections from web workers.
How to hunt for it
Hunt in web and PHP telemetry, not in application logs. Start the search window before 17 October and focus on internet facing hosts first.
| Layer | What to look for | Where to look |
|---|---|---|
| Request | Multipart bodies with PHP_SESSION_UPLOAD_PROGRESS, deep nesting, missing Content-Length, chunked uploads, high part counts, known user agents and boundaries | Reverse proxy, WAF and web server access logs |
| PHP and server errors | "Allowed memory size exhausted", "in Unknown on line 0", timeouts, segfaults, respawn bursts in FPM and Apache | PHP, FPM and Apache error logs |
| Response | Oversized PHPSESSID Set-Cookie headers, high header byte counts | Proxy or load balancer logs |
| Session store | Long held locks on sess_* files, odd contents, PHP code or serialized objects in session files | session.save_path, /proc/locks |
| Process | PHP or the web server spawning sh, bash or cmd, or downloading files | EDR, auditd, Defender for Endpoint, process creation logs |
| Network | New outbound connections from web workers, reverse shells, unusual egress volume | Firewall, NetFlow, proxy |
Reuse existing detection content. Community Suricata, Sigma and Microsoft Sentinel rules keyed on the mechanics of the bug have been published, and several security vendors have released detections. Test any of them against your own traffic first.
Preserve evidence before you patch. Restarting workers wipes the in memory state that CVE-2026-109619 abuses. On any suspected host, capture PHP worker and web server memory, the process tree, network connections and open files first, then patch.
Escalate quickly if you see a shell spawned by the web user after multipart activity, session files containing code, or any hit on the structural indicators from a host you had not patched.
Action checklist and remediation
Patching is the only complete fix. PHP states there are no complete mitigations and that updating is the only safe choice.
Today
- Inventory every PHP install: web servers, containers, control panels (cPanel, Plesk), CMS hosts (WordPress, Drupal, Joomla, Magento), and vendor appliances or Windows software that bundle
php.exeorphp-cgi.exe. - Capture volatile evidence on any suspected host before patching or restarting.
- Patch internet facing hosts first, to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or to a fixed package from your Linux distribution or hosting vendor.
- Restart PHP-FPM and Apache, and rebuild container images. A patched file on disk does not help while the old code is still loaded in memory.
- Confirm the running version from a web served request, not the CLI, since the two often use different configurations.
- Take offline, or restrict to GET and HEAD, any externally reachable PHP you cannot patch yet.
This week
- Hunt back to at least 17 October using the table above.
- Rotate credentials, API keys, tokens and certificates readable by PHP on internet facing hosts that stayed unpatched after 20 October or show indicators.
- Alert when the web user spawns shells or downloads files, and baseline outbound traffic from web workers.
- Ask every vendor with a bundled PHP for a fixed build and a date.
- Review WAF rules and confirm managed rule sets are current. Expect payload mutation, so do not rely on them alone.
- Plan migration off end of life PHP.
End of life PHP (8.1 and older)
PHP ships no fix for these branches. Options, best first: upgrade to a supported branch; use a vendor backport (CloudLinux says it released fixed packages for ea-php52 through ea-php85 and every alt-php version, and your distribution may offer similar, so check its CVE tracker); or isolate the host while you migrate.
If you cannot patch yet
These reduce exposure but do not make a host safe. Treat any unpatched host as exposed.
| Control | Targets | Side effect or limit |
|---|---|---|
session.upload_progress.enabled = 0, set in php.ini or server config, not via ini_set or .user.ini | CVE-2026-109619 session path used in the demonstrated attack | Session based upload progress stops working. Restart workers. |
fatal_error_backtraces = 0 | CVE-2026-109619 on PHP 8.5 only | Fatal errors lose their backtraces |
memory_limit = -1 via php_admin_value, with cgroup or container memory limits | CVE-2026-109618, which relies on a predictable memory limit | Incomplete. One request can use all memory. Do not rely on RLIMIT_AS or RLIMIT_DATA. |
Low post_max_size (for example 8M, or 32M with uploads), plus caps on request size, parts and nesting at the proxy or WAF | CVE-2026-109618 | Can break legitimate uploads. Block multipart outright if unused. |
session.use_only_cookies = On, session.use_strict_mode = On, pm.max_requests = 1 in FPM | Extra hardening | pm.max_requests = 1 has an operational cost |
What is still unknown
This is a fast moving situation, current as of 22 October 2026. We will revise this post as better data arrives.
- Successful compromise. Reports describe attempts, and several vendors say theirs failed. Nobody has published confirmed intrusions or post exploitation indicators such as payload hashes or command and control domains.
- Who is behind it. Amazon says the variety of payloads and the anonymization infrastructure point to multiple threat actors, and it is unclear how the actor active on 17 October got exploit details during the embargo.
- Conflicting early statements. Huntress and CISA said on 21 October they had not observed exploitation, while Amazon says it is broadly exploited. The gap reflects timing and visibility, so assume exposure.
- Detection coverage. Payloads are being mutated to evade WAF rules, and the likely traces are sparse. Absence of hits is weak evidence.
- End of life estates. More than a million internet facing hosts run PHP branches with no upstream fix. Watch for vendor backports and for exploitation shifting toward them.
How you would be protected with Cybereinforce
Patching closes PHP2Shell on your own servers. Cybereinforce protects your people from everyone else's. Web servers that attackers take over are routinely reused to host phishing pages and malware, and thousands of unpatched PHP sites will be in that position this month.
- Hijacked sites are blocked in the browser, the moment our intelligence marks them, without waiting for a takedown.
- Every block reaches your SOC as an event in Microsoft Defender and Microsoft Sentinel.
- We watch the entire web, so lookalikes of your own brand are found before they are used against you.
If you find indicators we have not listed, tell us and we will add them.
